Semvar like ^4 in package.json seems to behaves differently in pnpm than npm

[ZYinMD]

If I'm not mistaken, if I clone a repo where something like "react": "^16" was manually written in package.json, npm i will install the latest version like 16.14.0, but pnpm i will install 16.0.0. This causes bugs that are hard to catch. And when I do catch them it's hard to diagnose until I look into the lock file and realized what happened.

[thynson]

See https://pnpm.io/npmrc#resolution-mode.
pnpm 8 opt-in lowest-direct by default, but if it became a problem for you, change it to highest which shall be the same with npm and yarn.
And, if [email protected] is known to be bugged, you should increase the version range to avoid these version, rather than rely on the behavior of a package manager. Because it's still valid for any package manager to install [email protected] for you, e.g., someone clone your repo and install dependencies in offline mode and only [email protected] is cached on his/her local cache.